Done

Author: Maltesius

report/src/sections/appendix/03-bpplus.tex

@@ -1,3 +1,101 @@
 
 \section{Curdleproofs Weighted Inner Product Argument Modification Attempt}\label{app:curdleproofs-weighted-inner-product-argument-modification-attempt}
-We have made code for the~\gls{ipa} in the Curdleproofs repository which actually works with Bulletproofs+' Weighted Inner Product Argument.
+In the following, we will show our unsuccessful attempt in trying to convert the~\gls{dlipa} into a~\gls{wipa}.
+
+Before this, it should be mentioned that we have made code for the~\gls{ipa} in the Curdleproofs repository which actually works with Bulletproofs+'
+Weighted Inner Product Argument.
+Both the prover and verifier work.
+The problem is connecting it to the rest of the Curdleproofs protocol.
+
+First, the~\gls{dlipa} stems from the grand product argument that it has been converted from.
+Hence, it would make sense to try and modify the structure of this.
+
+The grand product argument compiles the grand product $p$ down to an equation that can be expressed as an inner product~\cite{Curdleproofs}.
+The equation is:
+\begin{align}
+    p\beta^{\ell}-1=\sum_{i=1}^{\ell}c_i(\beta^i  b_i-\beta^{i-1})
+\end{align}
+This can be seen as the inner product $z=\mathbf{c}\times\mathbf{d}$, where $z=p\beta^\ell-1$ and $d_i=(\beta^i b_i-\beta^{i-1})$,~$i\in[1,\ell]$.
+
+We will now follow the exact same conversion from grand product to inner product as in Curdleproofs.
+This includes four steps; \textit{separate}, \textit{compress}, \textit{rearrange}, and \textit{compile}.
+But instead of converting from the grand product $p=\Pi_{i=1}^\ell b_i$, we try the conversion with $p=\Pi_{i=1}^\ell b_i^{y_i}$.
+Here, $y$ is a Vandermonde vector of challenges, e.g., $y=\{y^0,y^1,\dots,y^{\ell-1}\}$
+
+\subsection{Separate}\label{subsec:separate}
+The grand product $p=\Pi_{i=1}^\ell b_i^{y_i}$ has $\ell-1$ multiplication, which we separate into $\ell+1$ checks
+\begin{align}
+    c_1=1^{y_0}\land c_{i+1}=b_{i}^{y_{i}}c_i,\text{ }i\in[1,\ell)\land p=b_{\ell}^{y_{\ell}}c_{\ell}
+\end{align}
+As explained by Curdleproofs, the final check $p=b_{\ell}^{y_{\ell}}c_{\ell}$ enforces the grand product $p=\Pi_{i=1}^\ell b_i^{y_i}$.
+\subsection{Compress}\label{subsec:compress}
+All equations are combined into a single polynomial to ensure that they hold
+\begin{align}
+    0&=(1-c_1)+(b_{1}^{y_{1}}c_1-c_2)X+(b_{2}^{y_{2}}c_2-c_3)X^2+\\
+    &\dots+((b_{\ell-1}^{y_{\ell-1}}c_{\ell-1}-c_\ell))X^{\ell-1}+(b_{\ell}^{y_{\ell}}c_{\ell}-p)X^{\ell}
+\end{align}
+
+\subsection{Rearrange \& Compile}\label{subsec:rearrange}
+Now, this next step is where the equations start to create problems.
+In Curdleproofs they rearrange the $\mathbf{c}$ terms.
+For example, if the shuffle size was 3, the equation would become
+\begin{align}
+    c_1(Xb_1-1)+c_2(X^2b_2-X)+c_3(X^3b_2-X^2)
+\end{align}
+Or equivalently by using the values of each equation in $\mathbf{c}$
+\begin{align}
+    1(Xb_1-1)+b_1(X^2b_2-X)+(b_1b_2)(X^3b_3-X^2)
+\end{align}
+This can also be stated as
+\begin{align}
+    \sum_{i=1}^{\ell}c_i(X^{i}b_{i}-X^{i-1})
+\end{align}
+Simplifying this equation, one gets
+\begin{align}
+    b_{1}b_{2}b_{3}X^3-1=pX^{\ell}-1
+\end{align}
+By the Schwartz-Zippel Lemma, as explained by Curdleproofs, the following inner product holds with overwhelming probability if at a random point $\beta$:
+\begin{align}
+    p\beta^{\ell}-1=\sum_{i=1}^{\ell}c_i(\beta^{i}b_i-\beta^{i-1})
+\end{align}
+Or just $z=\mathbf{c}\times\mathbf{d}$.
+
+Now we will try to do the same thing with our equations, that include the weights $\mathbf{y}$.
+Keep in mind, for the~\gls{wipa} to work, we need the following structure:
+\begin{align}\label{eq:structure}
+    \sum_{i=1}^{\ell}c_i\cdot d_i\cdot y_i
+\end{align}
+Hence, in the following conversion, that structure is our goal.
+
+Following the compression from the previous section, we will therefore see, if it have the structure of~\autoref{eq:structure} after the rearrangement and compilation.
+Again, we use size 3 for the example.
+As in the Curdleproofs case, we rearrange the $\mathbf{c}$ terms to be
+\begin{align}
+    c_1(X b_1^{y_1}-1)+c_2(X^2 b_2^{y_2}-X)+c_3(X^3 b_3^{y_3}-X^2)
+\end{align}
+Again, we insert the values of $\mathbf{c}$.
+\begin{align}
+    1(X b_1^{y_1}-1)+b_1^{y_1}(X^2 b_2^{y_2}-X)+(b_1^{y_1}b_2^{y_2})(X^3 b_3^{y_3}-X^2)
+\end{align}
+This simplifies down to
+\begin{align}
+    b_1^{y_1}b_2^{y_2}b_3^{y_3}X^3-1=pX^{\ell}-1
+\end{align}
+
+Unfortunately, this does not match the structure that we set as our goal in~\autoref{eq:structure}.
+
+Instead, we can try to work directly from the given structure shown in~\autoref{eq:structure}, and see what we get.
+We now use $p=\Pi_{i=1}^\ell b_i$.
+\begin{align}
+    \sum_{i=1}^{\ell}c_i(\beta^{i}b_i-\beta^{i-1})y_i
+\end{align}
+Here, a problem arises.
+If we still look at the example with shuffle size 3,
+\begin{align}
+    1(Xb_1-1)y_1+b_1(X^2b_2-X)y_2+(b_1b_2)(X^3b_3-X^2)y_3
+\end{align}
+we are not able to simplify this equation.
+This means that the verifier would need to know the values of $\mathbf{c}$ and $\mathbf{d}$ to compute~$z$.
+This breaks zero-knowledge, so the conversion is not useful.
+
+Hence, we believe bigger protocol changes are needed if one wants to implement the~\gls{wipa} in Curdleproofs